Hunt
Skip to content

HTML Entity Encoder / Decoder

Escape text so it shows literally in HTML, inside an element or an attribute, or turn HTML entities such as &, é and 😀 back into characters. Decoding follows the HTML5 rules browsers use, with all 2,231 named entities. Nothing is uploaded.

Runs in your browser

Text

Paste text or press Sample

Result

The result will appear here

What to escape, and where

  • Inside an element, escape & and < (and > for good measure): &amp;, &lt;, &gt;. Otherwise <script> in user text becomes a real tag.
  • Inside a quoted attribute, also escape the quote character: &quot; for double quotes, &#39; or &apos; for single quotes.
  • Escaping protects against cross-site scripting only in these two places. In URLs, scripts and styles, use the escaping that language needs; for URLs, the URL Encoder.
  • Pages served as UTF-8 don't need entities for accented letters or emoji; Also non-ASCII characters is for systems that only accept ASCII, such as some email templates.

How to use the HTML Entity Encoder / Decoder

  1. Choose Encode or Decode.
  2. Paste the text or HTML, or press Sample.
  3. When encoding, choose what to escape: element text, attribute values, all special characters, or non-ASCII characters too.
  4. Copy the result.

Examples

Escape a snippet to show it on a page

Input
<a href="/search?q=fish&chips">Fish & chips</a>
Output
&lt;a href="/search?q=fish&amp;chips"&gt;Fish &amp; chips&lt;/a&gt;

Quotes don't need escaping in element text, so they're left alone.

Non-ASCII characters as entities

Input
Café — 5 > 3 😀
Output
Caf&eacute; &mdash; 5 &gt; 3 &#128512;

Characters with a named entity use it; others, such as emoji, get a numeric reference.

Decode entities

Input
&lt;p class=&quot;intro&quot;&gt;Caf&eacute; &amp; cr&egrave;me&lt;/p&gt; &copy; 2026 &#8212; &#x1F600;
Output
<p class="intro">Café & crème</p> © 2026 — 😀

Decoding like a browser

Browsers accept some entities without their final semicolon, for historical reasons: &copy 2026 shows ©. The rules are subtle: &notit; becomes ¬it; because &not is a legacy entity. This tool decodes exactly as browsers do, so the result matches what a page shows.

Options

Encode / Decode
Escape text for HTML, or turn entities back into characters.
Escape
Text content (& < >), attribute values (adds "), all special characters (adds '), or all of those plus every non-ASCII character.
Named entities
With non-ASCII characters: use names like &eacute; where they exist, or numeric references like &#xE9; throughout.

Limitations

  • Encoding escapes the whole input as text: it doesn't parse HTML and leave tags alone.
  • Escaping for JavaScript strings, CSS or URLs needs different rules.

Frequently asked questions

Is my text uploaded?

No. Encoding and decoding run in your browser; nothing you paste is sent anywhere.

What's the difference between &apos; and &#39;?

Both mean a single quote. &apos; is defined in HTML5 and XML but not in HTML 4, so &#39; is the safer choice for old email clients; browsers today accept both.

How do I escape HTML in JavaScript?

Set element.textContent instead of innerHTML, and the browser escapes for you. To build a string, replace & first, then <, >, " and '. Frameworks such as React escape text automatically.

Why do I see &amp;amp; on my page?

The text was escaped twice: & became &amp;, then &amp; became &amp;amp;. Escape once, at the point where text is inserted into HTML.